Collect the sar statistics using cron job – sa1 and sa2

If you’ve installed sysstat from source, the default location of sa1 and sa2 is /usr/local/lib/sa. If you’ve installed using your distribution update method (for example: yum, up2date, or apt-get), this might be /usr/lib/sa/sa1 and /usr/lib/sa/sa2.

/usr/local/lib/sa/sa2

This runs close to midnight (at 23:53) to create the daily summary report of the sar data.

sa2 creates /var/log/sa/sarXX file (Note that this is different than saXX file that is created by sa1). This sarXX file created by sa2 is an ascii file that you can view it in a text editor.

This will also remove saXX files that are older than a week. So, write a quick shell script that runs every week to copy the /var/log/sa/* files to some other directory to do historical sar data analysis.

II. 10 Practical Sar Usage Examples

There are two ways to invoke sar.

sar followed by an option (without specifying a saXX data file). This will look for the current day’s saXX data file and report the performance data that was recorded until that point for the current day.

sar followed by an option, and additionally specifying a saXX data file using -f option. This will report the performance data for that particular day. i.e XX is the day of the month.

In all the examples below, we are going to explain how to view certain performance data for the current day. To look for a specific day, add “-f /var/log/sa/saXX” at the end of the sar command.

All the sar command will have the following as the 1st line in its output.

$ sar -u
Linux 2.6.18-194.el5PAE (dev-db) 03/26/2011 _i686_ (8 CPU)

Linux 2.6.18-194.el5PAE – Linux kernel version of the system.

(dev-db) – The hostname where the sar data was collected.

03/26/2011 – The date when the sar data was collected.

_i686_ – The system architecture

(8 CPU) – Number of CPUs available on this system. On multi core systems, this indicates the total number of cores.

1. CPU Usage of ALL CPUs (sar -u)

This gives the cumulative real-time CPU usage of all CPUs. “1 3″ reports for every 1 seconds a total of 3 times. Most likely you’ll focus on the last field “%idle” to see the cpu load.

Note: The “blocked” column displays the number of tasks that are currently blocked and waiting for I/O operation to complete.

Following are few variations:

sar -q

sar -q 1 3

sar -q -f /var/log/sa/sa10

9. Report network statistics (sar -n)

This reports various network statistics. For example: number of packets received (transmitted) through the network card, statistics of packet failure etc.,. “1 3″ reports for every 1 seconds a total of 3 times.

sar -n KEYWORD

KEYWORD can be one of the following:

DEV – Displays network devices vital statistics for eth0, eth1, etc.,

EDEV – Display network device failure statistics

NFS – Displays NFS client activities

NFSD – Displays NFS server activities

SOCK – Displays sockets in use for IPv4

IP – Displays IPv4 network traffic

EIP – Displays IPv4 network errors

ICMP – Displays ICMPv4 network traffic

EICMP – Displays ICMPv4 network errors

TCP – Displays TCPv4 network traffic

ETCP – Displays TCPv4 network errors

UDP – Displays UDPv4 network traffic

SOCK6, IP6, EIP6, ICMP6, UDP6 are for IPv6

ALL – This displays all of the above information. The output will be very long.

10. Report Sar Data Using Start Time (sar -s)

When you view historic sar data from the /var/log/sa/saXX file using “sar -f” option, it displays all the sar data for that specific day starting from 12:00 a.m for that day.

Using “-s hh:mi:ss” option, you can specify the start time. For example, if you specify “sar -s 10:00:00″, it will display the sar data starting from 10 a.m (instead of starting from midnight) as shown below.

You can combine -s option with other sar option.

For example, to report the load average on 26th of this month starting from 10 a.m in the morning, combine the -q and -s option as shown below.

In the point no. 10, end option can be use as follows.
sar -q -f /var/log/sa/sa08 -s 09:04:00 -e 15:00:00
this will display between 09:04:00 a.m. to 15:00:00 (3 p.m.) output
Thanks to you for such a nice artical.

I am trying to prove to a customer that they have their file systems set up wrong. They have multiple applications, SAS, ndm, and other running on a system and are using one large multi-terebyte file system for all of them. They keep wanting to blame disk I/O for poor performance. I realize that is probably the problem but should be addressed by chaning the file system layout to minimize issues first. If you could guide me in how to present either sar, iostat, vmstat, or some other information to them to prove this I would appreciate it.

i am dying to know how to figure this out: I have download the latest version of sysstat (10.0.4) and already did the 2 initial steps for the installation into my Centos 5 (on a VMWare). The problem is when i type the command “make” after compiling with “./configure”. I got many errors that don’t let me install the sysstat.
This are some of the errors i got:
make: o: No se encontró el programa (english= “didn’t find the program)
make: [nls/sv.gmo] Error 127 (no tiene efecto)

Hello Ramesh,
I read about a functionality for measuring CPU temperature using sysstat. I couldn’t find the command for doing that. Do you have any idea regarding this? If yes, I think it would be a nice addition to the blog

Hi,
I had installed the above mentioned step and it was successful.
I am getting error while executing without providing any number
vishal@vishal-Aspire-5920:~$ sar -u
Cannot open /var/log/sysstat/sa10: No such file or directory
Please check if data collecting is enabled in /etc/default/sysstat
vishal@vishal-Aspire-5920:~$ sar -r
Cannot open /var/log/sysstat/sa10: No such file or directory
Please check if data collecting is enabled in /etc/default/sysstat

I’m doing some personal training on Linux, and testing several bechmarks tools. There is something that I don’t understand clearly about the “sar -w” option.
I tried to figure out what the “number of context switches per second” means. Could you give me more details about it?

In the crontab entry, you should not be limiting the interval to 1 second. Sar uses the same system resources no matter how long the interval is. It reads kernel values, sleeps, reads the values again and records/prints the difference value. 1 second, 10 seconds, 1200 seconds are the same as far as sar’s resource usage. 99.99% of sar’s usage is sleep, which is what the kernel does anyway when it’s not doing anything. Note below that the first sar sample of only a second showed an average cpu of 3%. The longer samples, averaging over a longer period, show that 6% is probably more of an accurate average, at this time. The web pages I’ve seen so far feed each other with this 1 second sample thing, almost like someone is afraid sar might bog the system down. It won’t. The same two sets of kernel reads happens no matter what the interval is:

From the man page example it shows each hour having 3 20 minute samples. This provides accurate averaging and small sa## files. A 1 second interval each 10 minutes is 1/600th of the information available.

EXAMPLES
To create a daily record of sar activities, place the following entry
in your root or adm crontab file:

[root@TEST1 kSar-5.0.6]# ./run.sh
Exception in thread “main” java.awt.HeadlessException:
No X11 DISPLAY variable was set, but this program performed an operation which requires it.
at java.awt.GraphicsEnvironment.checkHeadless(GraphicsEnvironment.java:159)
at java.awt.Window.(Window.java:431)
at java.awt.Frame.(Frame.java:403)
at java.awt.Frame.(Frame.java:368)
at javax.swing.SwingUtilities$SharedOwnerFrame.(SwingUtilities.java:1731)
at javax.swing.SwingUtilities.getSharedOwnerFrame(SwingUtilities.java:1808)
at javax.swing.JWindow.(JWindow.java:168)
at net.atomique.ksar.SplashScreen.(SplashScreen.java:29)
at net.atomique.ksar.Main.doSplashScreen(Main.java:379)
at net.atomique.ksar.Main.start_gui(Main.java:458)
at net.atomique.ksar.Main.main(Main.java:289)

About The Geek Stuff

My name is Ramesh Natarajan. I will be posting instruction guides, how-to, troubleshooting tips and tricks on Linux, database, hardware, security and web. My focus is to write articles that will either teach you or help you resolve a problem. Read more about Ramesh Natarajan and the blog.